What this actually is.
Technical background, root cause, and affected surface.
JmsBinding.extractBodyFromJms() in camel-jms (and equivalent classes in camel-sjms, camel-sjms2, camel-amqp) calls javax.jms.ObjectMessage.getObject(), which internally calls ObjectInputStream.readObject() without any ObjectInputFilter, class allowlist, or denylist. The code path is reached whenever mapJmsMessage=true (default) and Camel acts as a JMS consumer, meaning any JMS producer sending an ObjectMessage can trigger arbitrary code execution.
- Vendor
- Apache
- Product
- Apache Camel
- Severity
- Critical
- CVSS Score
- 9.8
- Status
- Published
- CWE
- CWE-502: Deserialization of Untrusted Data
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
JmsBinding.java: extractBodyFromJms() -> objectMessage.getObject() -> ObjectInputStream.readObject() (no filter); mapJmsMessage=true by default exposes all JMS consumers
Root cause: ObjectInputStream deserialization of JMS ObjectMessage payload without ObjectInputFilter, class allowlist, or denylist
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker who can produce JMS ObjectMessage to any queue or topic consumed by a Camel route using camel-jms, camel-sjms, camel-sjms2, or camel-amqp with default mapJmsMessage=true configuration
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Arbitrary code execution on the Camel consumer host; potential full system compromise; data exfiltration from all systems accessible from Camel host
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Apache Camel 4.14.7, 4.18.2, or 4.20.0 which apply ObjectInputFilter. As immediate mitigation, set mapJmsMessage=false. Restrict JMS broker access to authenticated and trusted producers.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
2026-04-27: CVE published | 2026-04-26: Fix released in Camel 4.14.7, 4.18.2, 4.20.0
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.